Entity · DiggingBeagle record
ARTEX
ARTEX is an AI-assisted penetration-testing harness previously available as open source. October 2026 investigation linked it to threat-actor infrastructure targeting South Korean financial organizations; its operator logs and configuration were exposed through unauthenticated directories. The developer then announced the end of public releases and closed-source status; Reuters reported the GitHub page was removed on October 9. The number of confirmed victims and precise tool role remain uncertain.
Record description
ARTEX is a Chinese-developed AI-assisted penetration-testing harness that was publicly available as source code before October 2026. CrowdStrike reports that an operator used an ARTEX instance alongside model backends and separate Claude Code sessions during a campaign associated with South Korean finance data exfiltration. The first-party investigation associated an ARTEX host with a second operator-controlled server containing accessible sessions, memory and configuration. These exposed operator files are not evidence that ARTEX's publisher, Anthropic or the model providers lost their own customer histories. ARTEX is a control and orchestration tool rather than an independent foundation model, and the analysis does not prove it autonomously performed every attack step. On October 9 Reuters attributed to its developer a decision to stop public releases and maintenance and remove the repository, but this does not establish that prior copies disappeared, that a product security patch was issued, or that every reported target was compromised.